ka at pacific.net
Sun Apr 1 05:50:30 CEST 2007
Glenn Steen wrote:
> On 30/03/07, Ken A <ka at pacific.net> wrote:
>> re: http://www.securityfocus.com/archive/1/464269
>> Am I correct that a line like so in filetype.rules.conf will block
>> animated cursors.
>> deny RIFF No animated cursors No animated cursor
>> They are already blocked in filename.rules.conf, but you know how
>> windows apps like to open files based on contents!
> Yes... and then some (RIFF is a container thing)... Observe:
> # file /mnt/win_c/WINDOWS/Cursors/handno.ani
> /mnt/win_c/WINDOWS/Cursors/handno.ani: RIFF (little-endian) data,
> animated cursor
> # file /usr/lib/childsplay/lib/MultiTablesData/correct.wav
> /usr/lib/childsplay/lib/MultiTablesData/correct.wav: RIFF
> (little-endian) data, WAVE audio, Microsoft PCM, 8 bit, mono 22050 Hz
> Might be OK for you, but perhaps you shouldn't assume it to be an
> animated cursor right off the bat:-). Why not use "cursor" or even
> "animated" instead? A plain cursor file (.cur) is identified as some
> Lotus 1-2-3 format on my system here:-).
Thanks Glenn, I wasn't sure of how the regex worked for the rules file
and chose the all caps RIFF, rather than 'cursor' or 'animated'.
Changing to 'animated'.
More information about the MailScanner